Daniel Lunghi
9 articles
-
BlogSHADOW-VOID-042 Targets Multiple Industries with Void Rabisu-like Tactics
In November, a targeted spear-phishing campaign was observed using Trend Micro-themed lures against various industries, but this was quickly detected and thwarted by the Trend Vision One™ platform.
December 11th, 2025 10 minDaniel Lunghi, Ian Kenefick, Feike Hacquebord
Read article -
BlogThe Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns
Trend™ Research examines the complex collaborative relationship between China-aligned APT groups via the new “Premier Pass-as-a-Service” model, exemplified by the recent activities of Earth Estries and Earth Naga.
October 22nd, 2025 16 minDaniel Lunghi, Leon M Chang
Read article -
BlogUpdated Shadowpad Malware Leads to Ransomware Deployment
In this blog entry, we discuss how Shadowpad is being used to deploy a new undetected ransomware family. Attackers deploy the malware by exploiting weak passwords and bypassing multi-factor authentication.
February 20th, 2025 12 minDaniel Lunghi
Read article -
BlogMOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks
Trend Micro’s monitoring of the MOONSHINE exploit kit revealed how it’s used by the threat actor Earth Minotaur to exploit Android messaging app vulnerabilities and install the DarkNimbus backdoor for surveillance.
December 5th, 2024 15 minJoseph C Chen, Daniel Lunghi
Read article -
BlogEarth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks
Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa.
March 18th, 2024 14 minJoseph C Chen, Daniel Lunghi
Read article -
BlogIron Tiger’s SysUpdate Reappears, Adds Linux Targeting
We detail the update that advanced persistent threat (APT) group Iron Tiger made on the custom malware family SysUpdate. In this version, we also found components that enable the malware to compromise Linux systems.
March 1st, 2023 14 minDaniel Lunghi
Read article -
BlogIron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users
We found APT group Iron Tiger's malware compromising chat application Mimi’s servers in a supply chain attack.
August 12th, 2022 8 minDaniel Lunghi, Jaromir Horejsi
Read article -
ResearchExposing Earth Berberoka: A Multiplatform APT Campaign Targeting Online Gambling Sites
Our research uncovers the tools and techniques used by Earth Berberoka across different platforms to target online gambling sites.
May 24th, 2022 6 minDaniel Lunghi, Jaromir Horejsi
Read article -
BlogAPT-C-36 Updates Its Spam Campaign Against South American Entities With Commodity RATs
We have continued tracking APT-C-36, also known as Blind Eagle, since our research on this threat actor in 2019. We share new findings of APT-C-36’s ongoing spam campaign targeting South American entities.
September 13th, 2021 6 minDaniel Lunghi
Read article